@bobfrankston/mailx-types 0.1.71 → 0.1.73

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bobfrankston/mailx-types",
-  "version": "0.1.71",
+  "version": "0.1.73",
   "type": "module",
   "main": "index.js",
   "types": "index.d.ts",

package/trust.d.ts

@@ -56,6 +56,14 @@ export interface TrustInput {
     ownAddresses: string[];
     /** Sanitized HTML body, for the link-construct checks. */
     bodyHtml: string;
+    /** The reader has approved this sender or its domain in allowlist.jsonc —
+     *  "Always: *@icecer.com" in the remote-content banner, or "Trust all
+     *  senders at ‹domain›" in the address menu. It answers the only question
+     *  a spam score cannot: is this mail WANTED. It never silences forgery
+     *  evidence, and it counts only on a message whose sender was actually
+     *  proved — otherwise the list would be a switch a forger could flip by
+     *  typing a trusted address into From. */
+    senderTrusted?: boolean;
     /** Plain-text body, for the character-level checks. Separate from the HTML
      *  because markup legitimately contains things prose does not, and the
      *  zero-width test would trip over an entity or an attribute value. */
@@ -105,6 +113,9 @@ export interface SpamScore {
      *  listed in the Spamhaus SBL blocklist)". A number alone is unactionable;
      *  this can be judged in a second. */
     reasons: string[];
+    /** The reader approved this sender AND the sender is proved: the score is
+     *  still true, and no longer worth showing. The viewer hides the chip. */
+    trusted: boolean;
 }
 export declare function spamScoreOf(input: TrustInput): SpamScore;
 //# sourceMappingURL=trust.d.ts.map

package/trust.js

@@ -354,6 +354,16 @@ function serverSpamVerdict(input) {
     const a = analyzeServerSpam(input);
     if (!a || !a.flagged)
         return null;
+    // Mail from a sender the reader has approved, whose identity is proved,
+    // and which nothing accuses of forgery: say nothing at all. The server's
+    // score answers "is this bulk", the reader has already answered "is it
+    // wanted", and repeating the first after the second is how a banner turns
+    // into furniture. (Bob 2026-08-28, having just clicked "Always:
+    // *@icecer.com" on a conference announcement: "I accepted the server so
+    // shouldn't this be considered safe?")
+    const trustedAndProved = input.senderTrusted && a.proved;
+    if (trustedAndProved && a.kind !== "forgery" && !a.authFailures.length)
+        return null;
     const numbers = Number.isFinite(a.score) && Number.isFinite(a.threshold)
         ? `SpamAssassin score ${a.score} of ${a.threshold}`
         : "flagged by SpamAssassin";
@@ -385,6 +395,13 @@ function serverSpamVerdict(input) {
             detail: `${numbers}${why}${bayes}`,
         };
     const proof = a.proved ? `${provedNote(a)} ` : "";
+    if (input.senderTrusted && !a.proved)
+        return {
+            id: "server-spam-verdict",
+            severity: "caution",
+            text: "This claims to be a sender you trust, but nothing proves it is.",
+            detail: `No DMARC pass, no valid signature from the sending domain, and it passed through hosts your server does not trust. ${numbers}${why}`,
+        };
     return {
         id: "server-spam-verdict",
         severity: "caution",
@@ -658,6 +675,7 @@ export function spamScoreOf(input) {
         kind: a.kind,
         proved: a.proved,
         provedBy: a.provedBy,
+        trusted: !!input.senderTrusted && a.proved && a.kind !== "forgery" && !a.authFailures.length,
         reasons: a.reasons,
     };
 }